无法修复npm semver中等安全漏洞的技术求助

我对npm了解有限，当前需要解决npm安全审计中发现的semver漏洞问题，审计报告如下：

# npm audit report

semver  <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service
No fix available
node_modules/@babel/core/node_modules/semver
node_modules/@babel/helper-compilation-targets/node_modules/semver
node_modules/@babel/helper-create-class-features-plugin/node_modules/semver
  @babel/core  *
  Depends on vulnerable versions of @babel/helper-compilation-targets
  Depends on vulnerable versions of semver
  node_modules/@babel/core
    @babel/helper-compilation-targets  *
    Depends on vulnerable versions of @babel/core
    Depends on vulnerable versions of semver
    node_modules/@babel/helper-compilation-targets
    @babel/helper-create-class-features-plugin  *
    Depends on vulnerable versions of @babel/core
    Depends on vulnerable versions of semver
    node_modules/@babel/helper-create-class-features-plugin
      @babel/plugin-transform-typescript  >=7.21.4-esm
      Depends on vulnerable versions of @babel/helper-create-class-features-plugin
      node_modules/@babel/plugin-transform-typescript
        @babel/preset-typescript  >=7.22.5
        Depends on vulnerable versions of @babel/plugin-transform-typescript
        node_modules/@babel/preset-typescript
    babel-plugin-jsx-dom-expressions  >=0.33.12
    Depends on vulnerable versions of @babel/core
    node_modules/babel-plugin-jsx-dom-expressions
      babel-preset-solid  0.17.0-beta.0 - 0.17.0-beta.3 || >=1.4.6
      Depends on vulnerable versions of @babel/core
      Depends on vulnerable versions of babel-plugin-jsx-dom-expressions
      node_modules/babel-preset-solid
        vite-plugin-solid  *
        Depends on vulnerable versions of @babel/core
        Depends on vulnerable versions of babel-preset-solid
        node_modules/vite-plugin-solid

9 moderate severity vulnerabilities

To address issues that do not require attention, run:
  npm audit fix

Some issues need review, and may require choosing
a different dependency.

我已尝试删除node_modules文件夹和package-lock.json文件后执行npm install，也试过运行npm audit fix，甚至安装旧版本semver，但这些方法都无法解决问题，希望得到技术帮助。

解决方案 #

这个问题源于项目依赖树中嵌套了多个未修复的旧版本semver，上游依赖暂未推送修复版本，可通过npm的overrides功能强制升级所有嵌套实例到安全版本：

1. 打开项目根目录的package.json，添加如下配置：

"overrides": {
  "semver": "^7.5.2"
}

2. 删除项目根目录下的node_modules文件夹和package-lock.json文件
3. 执行命令npm install重新安装依赖
4. 运行npm audit验证漏洞是否修复

原理说明 #

npm的overrides字段可强制让整个依赖树中所有引用指定包的地方，统一使用你指定的安全版本，无视子依赖原本声明的版本范围。这种方法无需等待上游依赖发布修复版本，就能快速解决嵌套依赖的安全漏洞。

内容的提问来源于stack exchange，提问作者Zübeyir